Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
156 Commits 1 Branch 0 Tags
7b50b599cf2de33019f542f33a9c3a3b0db45113
Commit Graph

108 Commits

Author SHA1 Message Date
canglan
7b50b599cf fix: infinite login loop from async auth validation 
- Add _validating flag to prevent recursive hashchange calls during async
  token validation
- route() checks _validating before calling validateAuth(), sets flag
  before async call, clears in .then/.catch handlers
- route() returns early if still validating (waits for completion)
- Fixes: expired token causing infinite login redirect loop
 2026-08-21 20:52:41 +08:00
canglan
e232f3b02e fix: auth expiry - validate token before showing protected pages 
- Add validateAuth() method: calls /api/me to verify token validity,
  clears Auth state on 401/login error
- route() now calls validateAuth() async for ALL protected pages
  BEFORE showing layout/sidebar/rendering content
- Extract _doRoute() for actual page rendering (runs after validation)
- init() uses API.get for install check (proper auth handling)
- Added reset() to Auth: clears localStorage without redirecting

This fixes: expired token showing login-required pages, and no feedback
when session expires mid-session.
 2026-08-21 20:46:09 +08:00
canglan
6ac8a5cd11 fix: site_name not loaded + expired token not cleared 
- app.js init(): use native fetch (no Bearer) to call /api/install/status
  and /api/settings/settings, so site_name loads even before login
  state is confirmed; call Auth.reset() if logged but no site_name set
- auth.js: add reset() method that clears TK/US without redirecting
- app.js route(): remove early return for uninstalled; let install check
  run first so init() can fall through to normal routing when installed
- app.js renderMain(): catch 401/login errors from page render, clear
  Auth state, show login prompt with button that redirects back after
  login (target hash preserved)
 2026-08-21 20:31:45 +08:00
canglan
8c5ce78fd0 chore: add AGPLv3 copyright header to all source files 
- 52 JS files (backend + public/js): header with
  Copyright (C) 2026 Sea Network Technology Studio
  Author: CangLan <admin@sea-studio.top>
  + AGPLv3 notice
- idempotent (skips if header present), all syntax-checked
 2026-08-19 20:27:05 +08:00
canglan
65edbaf157 refactor: session-based external auth, dynamic sources, drop netease UID 
Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
  old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients

Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
  (register, dashboard identity, users admin, bans), labels dynamic

UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
  dropped, frontend fields optional)

Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)
 2026-08-19 20:08:06 +08:00
canglan
6056153f57 security: external API - only ID+Secret auth, remove legacy key & JWT 
- removed x-external-key (single key) auth path + getExternalKey
- removed JWT passthrough in clientAuth (Bearer no longer accepted)
- removed /auth/login (JWT endpoint) and /my-tickets (JWT-only)
- clientAuth now mandatory: missing/invalid/disabled client -> 401
  (closed the 'no config = allow all' authorization bypass)
- moved /auth/register BEHIND clientAuth (was anonymous abuse surface)
- clients mgmt endpoints keep authenticate + role check (admin UI)
- docs + UI copy updated to single auth method
- verified: 30 checks incl. full-tree scan for legacy key refs
 2026-08-19 19:44:34 +08:00
canglan
257cd14051 feat: external API for QQ bot - client id+secret auth, ticket tracking, bans, per-server data 
- db: api_clients table + server_groups.alias + tickets/bans server_name (auto-migrate)
- external.js: client_id+secret auth (multi-client, bcrypt, show-once secret),
  legacy x-external-key compat, JWT pass-through
  - POST /tickets (optional server), GET /tickets/track?token= (full lifecycle)
  - GET/POST /bans, reported-players/stats/all-tickets with server filter
  - GET /servers (alias list), client CRUD (owner/admin, audit logged)
  - resolveServer: alias | 分组/子服 | server_name
- polls.js: server_groups CRUD with alias (add/edit, dup check)
- servers page: alias display + edit; new 外部API page: client mgmt + quick docs
- API.md: full external API section (auth matrix, server param syntax)
- verified: 37 checks incl. resolveServer sandbox (alias/group/fallback)
 2026-08-19 19:12:34 +08:00
canglan
a11df22600 feat: system logs - email log + system log with admin UI 
- db: email_logs (sent/failed) + system_logs (info/warn/error) tables,
  auto-migrated for existing installs
- backend/logger.js: logEmail/logSystem with try/catch (never breaks flow)
- mailer: log send result (SMTP unconfigured/sent/failed + error msg)
- webhook: log blocked-internal, non-2xx response, send failure
- server: error middleware records 500 errors to system_logs
- routes/logs.js: GET /logs/emails + /logs/system (admin/owner, filters)
- UI: 系统日志 page (owner/admin) with system/email tabs + filters
- API docs updated
 2026-08-17 05:14:41 +08:00
canglan
8d6c3c4a8d fix: notifications page crash + email code dev-mode false error 
- notifications.js: EventOptions(current) referenced undefined 'Current'
  (case typo) -> ReferenceError crashed add/edit modal, page unusable
- auth.js send-verify-code: dev mode (SMTP down) deleted captcha row before
  returning code, so register always failed with '验证码无效或已过期'
  even with correct code. Keep row; it's deleted after successful verify.
 2026-08-17 04:50:10 +08:00
canglan
1d669fd1d0 feat: skin site UUID lookup - auto-fetch UUID from player name 
- GET /settings/uuid-lookup?site=&name= : proxy Yggdrasil API
  (POST {site}/api/yggdrasil/api/profiles/minecraft), SSRF guard,
  10s timeout, name regex, UUID formatting (with dashes)
- GET /settings/skin-site : public read of configured skin site
- settings page: 皮肤站地址 config
- bind identity modals (player dashboard + admin users): 获取UUID button,
  auto-fill site from settings, auto-fill UID from lookup
- verified live against littleskin.cn (Steve -> df273bda...)
- API docs updated
 2026-08-17 02:05:21 +08:00
canglan
a6a548b1ce fix: identity bind row layout - select stole full width, inputs invisible 
Root cause: .form-group select global width:100% inherited inside flex row,
pushing the two text inputs to zero width. Fix: fixed 92px select
(flex:0 0 92px), inputs flex:1 1 30% with min-width:0 + width:auto,
button flex:0 0 auto, no wrap.
 2026-08-17 01:52:20 +08:00
canglan
25a766591e feat: admin user management supports multi-identity bind/unbind 
- users list: identity_count column (backend subquery)
- user detail: returns identities array
- POST /users/:id/identities, DELETE /users/:id/identities/:identityId
  (owner protection, dup checks, keep >=1, audit logs)
- users page: identity column in table + manage section in edit modal
- API docs updated
 2026-08-17 01:34:20 +08:00
canglan
559970c5b7 feat: one account can bind both netease + skin identities 
- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
  (netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity
 2026-08-17 01:17:09 +08:00
canglan
a5019f1b11 fix: invalid API key after install - force page reload to pick up injected key 2026-08-16 23:01:31 +08:00
canglan
1740a52cda fix: install page blank - init() early return skipped route registration 2026-08-16 21:27:46 +08:00
canglan
6e9101a506 fix: deploy crash + multiple bug fixes + cleanup 
- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts
 2026-08-16 21:21:25 +08:00
canglan
7bc22dee0c fix: add source field to dashboard ban form 2026-07-19 00:40:54 +08:00
canglan
19615cfa56 feat: edit ban entries with modal form 2026-07-18 01:53:24 +08:00
canglan
5cb17228a8 fix: missing duration dropdown in bans add form 2026-07-18 01:41:37 +08:00
canglan
dce812aa2f feat: bans show account source + ban source (ticket/manual) 2026-07-18 01:35:30 +08:00
canglan
ce51abc127 fix: add source field to bans + display in list 2026-07-18 01:26:37 +08:00
canglan
d242786a3a feat: bans sidebar page, public view with masked names 2026-07-18 01:17:40 +08:00
canglan
2e09dd2d3a fix: pass bans to renderContent, restore exports wrapper 2026-07-18 01:14:43 +08:00
canglan
2a12e7b740 fix: ban duration >= not >, auto-prefill min duration 2026-07-18 01:11:41 +08:00
canglan
5ed109ec0e feat: ban list with dashboard widget, owner add/edit bans 2026-07-18 00:52:33 +08:00
canglan
5497de9aac feat: batch ticket operations (close/delete/change status) 2026-07-17 21:55:15 +08:00
canglan
6dfc6788e5 fix: show target UID when name is empty in ticket list 2026-07-17 19:25:39 +08:00
canglan
1e1e8282e6 style: add spacing between code input and submit button 2026-07-17 15:05:01 +08:00
canglan
771e28472e fix: remove duplicate email field and extra send button 2026-07-17 14:57:33 +08:00
canglan
f21ea19789 fix: captcha input left, image right same row 2026-07-17 14:50:42 +08:00
canglan
96e55d8715 feat: anonymous ticket reply via tracking cookie 2026-07-17 14:16:21 +08:00
canglan
5e998b2201 fix: hide type tabs when embedded in home page 2026-07-17 13:41:29 +08:00
canglan
0bd32a1549 fix: keep top bar on home page, tabs stay in page content 2026-07-17 13:39:15 +08:00
canglan
0892dd5f8e fix: hide top bar on home page, tabs back in page content 2026-07-17 13:32:28 +08:00
canglan
d697ea1353 fix: add priority selector to ticket create form 2026-07-17 13:25:17 +08:00
canglan
9eb8aba371 fix: home page tabs in top bar, single nav layer 2026-07-17 13:21:30 +08:00
canglan
8f7c34dd86 fix: captcha full-width row, hide top-auth on anonymous submit page 2026-07-17 13:14:15 +08:00
canglan
fbd98ca801 fix: email back to original position, code+button after captcha 2026-07-17 01:51:40 +08:00
canglan
982437af06 fix: email after captcha, captcha required before sending code 2026-07-17 01:00:34 +08:00
canglan
292c863d95 style: register layout - email solo row, source+name together, code+captcha full width 2026-07-17 00:53:12 +08:00
canglan
3fdfb206cd style: cleaner register UI with email+code on same line 2026-07-17 00:47:15 +08:00
canglan
926bcb626b feat: send-code before register, dup game_name check, skin hides uid 2026-07-17 00:42:19 +08:00
canglan
511d5ab36f fix: inline email verification after registration, no separate page 2026-07-17 00:35:50 +08:00
canglan
ead50beccd feat: 6-digit email verification code, fix missing script+route includes 2026-07-17 00:34:47 +08:00
canglan
17bf5a611d feat: type tabs on create form (report/suggestion/appeal) 2026-07-17 00:21:48 +08:00
canglan
2961ca67d1 fix: sidebar highlights tickets-create when on create form 2026-07-17 00:10:34 +08:00
canglan
1762b016cd fix: tickets-create route matches create?type param, proper redirect 2026-07-17 00:09:02 +08:00
canglan
c3cd97676e fix: create user server toggle only shows for admin/owner, initial state correct 2026-07-17 00:07:58 +08:00
canglan
18bb8152ef feat: multi-channel notifications (Discord/email/generic Webhook) 2026-07-16 23:51:09 +08:00
canglan
ab08b1a2a9 feat: feature discussion as separate detail page, not inline 2026-07-16 23:50:16 +08:00